Privacy Policy

1. Introduction & Scope

Welcome to Tizara ("Tizara", "we", "us", or "our"), a premier multi-tenant e-commerce Software-as-a-Service (SaaS) platform headquartered in Dubai, United Arab Emirates. This Privacy Policy governs the manner in which Tizara collects, uses, maintains, and discloses personal information collected from users, merchants, vendors, and storefront customers across our web applications, APIs, and services.

By accessing or using our platform, creating a merchant store, or placing an order through a Tizara-powered storefront, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller vs. Data Processor Roles

Under the UAE Personal Data Protection Law (PDPL), legal responsibilities vary based on how data is collected:

• Tizara as Data Controller: We act as the Data Controller for information provided directly by Merchants to register and administer their Tizara account, billing subscriptions, and customer support interactions.
• Tizara as Data Processor: For shopper and end-customer information processed via individual merchant storefronts (such as shopping carts, customer delivery addresses, and order items), the Merchant is the Data Controller, and Tizara acts strictly as the Data Processor executing transactions on the Merchant's behalf.

3. Personal Information We Collect

We may collect personal data in the following categories:

A. Merchant Account Information

• Full name, company name, trade license / e-trader details (if registered in the UAE).
• Email address, telephone / WhatsApp contact numbers.
• Billing address and payment subscription transaction identifiers.
• Custom domain configurations and store branding metadata.

B. Storefront Customer Data (Processed on behalf of Merchants)

• Customer contact details: Full name, phone number, and email address.
• Shipping and delivery addresses within the UAE and internationally.
• Order history, purchased SKUs, transaction totals, and payment status (COD, Card).

C. Technical & Diagnostic Information

• IP address, browser type, device identifiers, and operating system.
• Server-side conversion tracking telemetry, timestamp logs, and referral URLs.

4. How We Use Your Information

Tizara processes collected data for legitimate business purposes, including:

• Provisioning and maintaining isolated multi-tenant e-commerce store instances.
• Processing merchant subscriptions and managing automated monthly/annual billing.
• Enabling seamless order routing, inventory reservation, and courier tracking integrations.
• Providing real-time performance analytics, revenue dashboards, and fraud prevention checks.
• Delivering mandatory service announcements, security updates, and technical support.
• Complying with UAE legal obligations, tax audits (Federal Tax Authority), and law enforcement requests.

5. Legal Basis under UAE PDPL

In accordance with Article 4 and Article 5 of UAE Federal Decree-Law No. 45 of 2021, we process personal data under the following legal bases:

• Contractual Necessity: Execution of SaaS terms and merchant store provisioning.
• Legal Compliance: Adherence to UAE commercial licensing and accounting mandates.
• Legitimate Interests: Protecting platform security, preventing fraudulent transactions, and maintaining service reliability.
• Explicit Consent: Where consent has been provided for marketing and analytics tracking.

6. Multi-Tenant Isolation & Security Architecture

We employ industry-standard 256-bit TLS encryption in transit, strict access controls, scrypt password hashing, and automated Redis cache invalidation to ensure zero data leakage.

7. Cookies & Server-Side Pixel Tracking

Tizara uses minimal, functional cookies necessary for authentication (httpOnly, Secure, SameSite cookies) and CSRF protection.

For merchants utilizing Facebook Conversion API and server-side pixel tracking, customer event data (such as page views, add-to-cart, and purchases) is transmitted directly to advertising endpoints in an encrypted format to enhance conversion accuracy without exposing unauthorized third-party client trackers.

8. Third-Party Disclosures & Payment Gateways

Tizara does not sell, rent, or trade personal data. We disclose data solely to trusted sub-processors necessary to provide platform services:

• Payment Processors: Stripe Connect, SSLCommerz, and UAE payment gateways for secure, PCI-DSS certified payment processing. Tizara does not store raw credit card numbers.
• Cloud Infrastructure: High-performance regional cloud servers and Redis caching layers.
• Logistics & Courier Partners: Automated courier partners for order dispatch and delivery tracking.

9. Your Rights under UAE Law

Subject to UAE Federal Decree-Law No. 45 of 2021, data subjects possess the following statutory rights:

• Right to Access: Request a copy of the personal data processed by Tizara.
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of data where retention is no longer legally mandated.
• Right to Restrict Processing: Request limits on processing under specific contested conditions.
• Right to Data Portability: Obtain your merchant store data in a structured, machine-readable format.

10. Data Retention & Cross-Border Transfers

We retain personal data for the duration of the active merchant subscription and as required by applicable UAE commercial and taxation laws (typically 5 years for financial transaction records).

Where cross-border data transfers occur outside the UAE, Tizara ensures appropriate safeguards and adequacy certifications in compliance with UAE Data Protection Authority directives.

11. Contact Data Protection Officer

If you have questions, data subject requests, or privacy concerns, please contact our Compliance & Data Protection Office: